Executive brief
The GD Graphics Library, a widely used tool for creating and editing images programmatically, contains a flaw in how it handles very large images. An attacker can provide a specially crafted, oversized image that causes the system to hang or become unresponsive. This results in a denial of service, potentially crashing web servers or applications that process user-uploaded images.
Technical details
A denial of service vulnerability exists in libgd's gdImageCreate function due to improper input validation of image dimensions. The function fails to perform overflow checks when allocating memory for new images, a protection that was already present in the related gdImageCreateTrueColor function. By providing an image with extremely large dimensions, a remote attacker can trigger a system hang or resource exhaustion. This issue is resolved in version 2.2.4 by implementing the missing overflow checks.
Affected products
- libgd libgd before 2.2.4
Timeline
- 2017-01-26: advisory: NVD publication date
- 2017-01-31: patched: Debian released security update DSA-3777-1